Chapter 6 of 8 · EC-Council 312-39
Incident Response
Phases, network, application, email, insider and malware response, playbooks, EDR and XDR (25%).
- 6topics
- 30 minfast track
- 1diagrams and exhibits
- 25%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Incident Response and Its PhasesLearn what incident response is, how events, alerts and incidents differ, and the NIST and EC-Council incident handling phases…Diagram5 min
- 2Responding to Network Security IncidentsLearn how a SOC detects, contains and recovers from network incidents such as DoS, scanning, unauthorized access and spoofing for…5 min
- 3Responding to Application and Email Security IncidentsLearn how a SOC responds to web application attacks such as SQL injection and XSS, and to phishing and email compromise, for the…5 min
- 4Responding to Insider and Malware IncidentsLearn how a SOC responds to insider incidents with HR and legal, and to malware and ransomware with isolation, eradication and…5 min
- 5SOC Playbooks in Incident ResponseLearn what SOC playbooks and runbooks are, what a playbook contains, and how SOAR automates playbooks to speed incident response…5 min
- 6Enhanced Incident Response with EDR and XDRLearn how EDR and XDR collect telemetry, detect threats and contain incidents, and how they differ from antivirus, SIEM and SOAR…5 min
About this chapter
What this chapter covers
Incident Response is 25% of the EC-Council CSA 312-39 exam, tied with Incident Detection and Triage as the largest domain. It covers what incident response is, the NIST and EC-Council phases, how to respond to network, application, email, insider and malware incidents, SOC playbooks, and how EDR and XDR speed up response.
Questions are single-answer multiple choice, often "Which of the following" and short named scenarios. You are asked what an alert, log entry or IoC means and what the next triage or response step should be.
It has 9 outline topics, and six pages cover them.
How the topics fit together
The chapter starts with the process, then applies it to each incident type, then adds the tools that make it faster.
- The process page gives the order of actions that every other page follows.
- The incident type pages show what each attack looks like and how it is contained and removed.
- The playbook and EDR/XDR pages show how the SOC makes response repeatable and fast.
When a question asks what to do first after confirming an incident, the answer is almost always a containment step that preserves evidence, such as isolating the host from the network rather than powering it off.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with tables and examples.
- What to remember for the exam: the facts to memorize.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Try to name the next step for each short scenario before reading the answer. The exam often asks what to do first, or which tool fits.
Ready for more practice?
The full EC-Council 312-39 question bank has 700 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.